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PATENT CLAIMS 

1. A method for enforcing the fail-silent property in the time domain of remote 
communication computers (111, 114) of a fault-tolerant distributed 
computer system, in which a plurality of remote computers are connected 
via a distributor unit (101, 102), each remote computer has an independent 
communications control unit (210) with the corresponding connections to the 
communication channels, and the access to the communication channels 
occurs by a cyclical time-division multiple access method 

characterized in that 

the at least one distributor unit (101, 102) makes sure, by virtue of the 
correct transmission behavior of the remote computer (111, 114) that is 
known a priori by it, that a remote computer can only send successfully to 
the other remote computers within its statically assigned time slice. 

2. The method according to claim 1, further further characterized in that the at 
least one distributor unit (101, 102) switches from the "unsynchronized" 
state, in which receiving is possible via all input ports (311), after receiving a 
correct message, to the "synchronized" state, in which receiving is only 
possible via one input port during the time slice statically assigned to this 
input port. 

3. The method according to claim 1 or 2, further characterized in that the at 
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least one distributor unit (101, 102) switches from the "synchronized" state 
to the "unsynchronized" state when no correct message has been received 
since the last initialization message at any of its input ports (31 1) within an a 
priori specified time Interval. 

4. The method according to one or more of claims 1 to 3, further characterized 
In that in a distributor unit (101, 102) the content of arriving messages is 
evaluated as an additional fault recognition. 

5. The method according to one or more of claims 1 to 5, further characterized 
in that the at least one distributor unit (101, 102) assumes the 
"unsynchronized" state after "power-up". 

6. The method according to one or more of claims 1 to 6, further characterized 
in that the at least one distributor unit (101, 102) converts the arriving 
physical signals into digital fonn, using the local clock of the distributor unit, 
and converts them back into the physical form before sending them. 

7. The method according to one or more of claims 1 to 6, further characterized 
in that distributor units (101, 102) are connected to each other via 
communication channels (201 , 202) in order to enable the power-up and 
clock synchronization of a distributor unit, even when no messages arrive at 
its own connections. 

8. The method according to one or more of claims 1 to 6, further characterized 
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in that distributor units are connected via dedicated communication 
channels (141, 142) to at least one maintenance computer, which performs 
the parameterization of the distributor units and monitors the correct 
functioning of the distributor units during operation. 

9. A distributor unit (101, 102) of a fault-tolerant distributed computer system, 

by which a plurality of remote computers (111 114) are connected to 

each other, each remote computer has an independent communications 
control unit (211) with corresponding connections to the communication 
channels (201, 202), and access to the communication channels occurs by 
a cyclical time-division multiple access method, 

further characterized in that 

the at least one distributor unit (101, 102) is designed to make sure, by 
virtue of the proper transmission behavior of the remote computer that is 
known a priori by it, that a remote computer can only send successfully to 
the other remote computers within its statically assigned time slice. 

10. The distributor unit (101, 102) according to claim 9, designed to carry out 
the method according to one of claims 2 to 8. 
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